ci: gate auto-approve behind SHADOW_AUTO_APPROVE (off by default)

Auto-approval now runs only where a maintainer has explicitly set the
repo/org variable SHADOW_AUTO_APPROVE=true. Default is off, so the bot is
comment-only unless deliberately enabled.

Rationale: a bot APPROVE review can satisfy branch protection's required
approving review. Making auto-approval opt-in keeps a human approval on the
critical path by default, addressing the AppSec review finding that the bot
could otherwise rubber-stamp a PR whose findings were suppressed via prompt
injection. The event guard (pull_request / pull_request_target) is unchanged.

Author: sudsali

.github/workflows/auto-approve.yml

@@ -12,7 +12,13 @@ permissions:
 jobs:
   approve:
     runs-on: ubuntu-latest
-    if: github.event.workflow_run.event == 'pull_request' || github.event.workflow_run.event == 'pull_request_target'
+    # Off by default: auto-approval only runs where a maintainer has explicitly
+    # set the repo/org variable SHADOW_AUTO_APPROVE=true. A bot approval can
+    # otherwise satisfy branch protection's required review, so keeping it opt-in
+    # means the bot stays comment-only unless a human deliberately enables it.
+    if: >-
+      vars.SHADOW_AUTO_APPROVE == 'true' &&
+      (github.event.workflow_run.event == 'pull_request' || github.event.workflow_run.event == 'pull_request_target')
     timeout-minutes: 2
 
     steps: